People type ‘encrypt’ into a search box when they mean three different things: prove a file did not change, give a row a unique ID, or keep a stranger out of an account. Those are hash, UUID, and password. Mixing them up produces systems that look technical and fail in boring ways. This guide uses three small jobs from the same fictional harbour workshop so the examples stay specific.
Job 1 — checksum the firmware blob
The workshop publishes `river-sensor-2026-09.bin`. Recipients need to know the download was not truncated. Hash the file bytes with SHA-256 in the Hash Generator (Web Crypto, in-tab). Publish the hex digest next to the download link. A mirror that disagrees has the wrong bytes.
SHA-256 is one-way. There is no ‘decode hash to get the firmware back’. There is also no secrecy: anyone can hash the file. Secrecy would be encryption with a key you do not publish. Do not hash a password in this tool and store it as the user password; that is fast SHA, no salt, no stretching — the opposite of a password KDF.
SHA-1 remains in the UI for legacy comparison (an old protocol that still prints SHA-1). Do not choose it for a new integrity check.
Job 2 — identify a volunteer shift row before sync
The fete app creates shift rows on a phone offline. Auto-increment integers collide when two phones sync. UUID version 4 (random, `crypto.getRandomValues`) is the identifier. Generate a batch, keep hyphens if the ORM expects 8-4-4-4-12. This is not a secret. Logs can print it. Do not use the UUID as the only ‘password’ on an unauthenticated URL and call it security — leaking the link leaks the capability.
UUID v4 is not a time-sortable ID. If you need roughly-ordered keys, that is ULID/KSUID/UUIDv7 territory, not this generator.
Job 3 — a 20-character registrar password
The domain registrar can transfer the shop’s hostname. The treasurer generates a long random password in the Password Generator, stores it in a password manager, and never pastes it into Slack. This value must stay secret. Hashing it with SHA-256 ‘to remember it’ is useless: you cannot get the password back, and a fast hash is what attackers want if they steal the hash.
Wi‑Fi for a weekend pop-up is a related but different secret. A QR that encodes the PSK is convenient on a stall and is also a poster of the key. Change the PSK on Monday. Do not reuse the registrar password as the travel-router password.
Base64 is a fourth job people confuse with these three
Base64 is an encoding so binary can sit in JSON or CSS. It expands size by ~33%. It is not a hash, not an ID scheme, and not encryption. The Base64 tool is the right place for a 612-byte SVG data URI. It is the wrong place to ‘hide’ an API key.
Quick chooser
If you remember nothing else:
- Did the file change? → SHA-256 (hash generator).
- Does this row need a unique ID? → UUID v4.
- Must a human prove knowledge to a server? → password manager + password generator.
- Must bytes travel through a text field? → Base64.
- Must bytes be secret from someone who has the file? → encryption in proper software, not these pages.
Tools used in this guide
More guides
Written by the ToolsGuru operators. No guest-post network, no scraped competitor pages. Corrections: contact@toolsguru.net.